Pairing computation device, pairing computation method, and pairing computation program

ABSTRACT

Provided are a pairing computation device, a pairing computation method, and a pairing computation program all of which enable fast pairing computation. The pairing computation device includes, where:
         E is an additive group of rational points on a pairable elliptic curve defined over F p   k  with an embedding degree of k, and the curve equation is given by y 2 =x 3 +ax+b where a∈F p  and b∈F p ,   E[r] is a set of rational points of a prime order r,   φ p  is Frobenius endomorphism, and   the order r and a trace t of the Frobenius endomorphism φ p  are used as functions of an integer variable χ:   computation means for computing a rational function f χ,Q (S);   computation means for computing a value of a rational point S(x s , y s ) on a line passing through a predetermined rational point;   computation means for computing a rational function f′ χ,Q (S) using computation results of these computation means; and   computation means for performing pairing computation by using the rational function f′ χ,Q (S) as Formula (1):       

         e ( Q,S )=ƒ′ χ,Q ( S ) (p−1)/r    (1).

TECHNICAL FIELD

The present invention relates to a pairing computation device, a pairing computation method, and a pairing computation program all of which enable fast pairing computation.

BACKGROUND ART

Conventionally, when an individual user uses a variety of services offered over a network such as the Internet, an authentication process is carried out to verify that the individual user is a legitimate user. In such an authentication process, authentication generally uses an ID and a password preset for each individual user. For this purpose, a network is provided with an authentication server for carrying out an authentication process.

Recently, using a digital signature technique, digital signature data unique to an individual user is attached to individual data. This digital signature data ensures that data utilized by an individual user is not tampered by outsiders or is not leaked to outsiders, so that confidential information can be safely handled over a network.

Meanwhile, with a digital signature, an individual user is identified in association with an authentication process at an authentication server, and as a result, history of each individual user is accumulated as information one after another in the authentication server every time an authentication process is performed. Therefore, private information such as which site individual users have accessed and which service they have used is accumulated in the authentication server. Thus, in terms of protection of personal information, great caution is given to prevent leakage of such information.

In order to solve accumulation of history information of individual users caused by the use of digital signatures, it is proposed to use a digital group signature, which is the extended digital signature.

When a digital group signature is used, an individual user transmits, to an authentication server, signature data that certificates that the individual user anonymously belongs to a particular group. The authentication server then verifies that the individual user belongs to a particular group without specifying the individual user from the received signature data. Therefore, while preventing fraud by an individual user who does not belong to a group, the authentication server authenticates an individual user without accumulating history information for each individual user.

For anonymous authentication in such a digital group signature, pairing computation is used.

Pairing computation uses a two-input and one-output function. For example, letting S be a rational point over a prime field F_(p) and Q be a rational point over a k-degree extension field F_(p) ^(k), when the two rational points S and Q are input, an element z in the extension field F*_(p) ^(k) is output. Moreover, pairing computation has a bilinear property such that when a times of the rational point S and b times of the rational point Q are input, the ab-th power of z is calculated. This bilinearity is utilized in authentication. Here, “k” is an embedding degree, and “F*_(p) ^(k)” is, strictly speaking, expressed as:

F*_(p) ^(k)   [Formula 1]

in mathematical representation, but is here represented as “F*_(p) ^(k)” due to limitations in expression.

In general, for each of the rational points S, Q, a point on an elliptic curve is used. The pairing computation of a rational point on an elliptic curve includes a step of performing computation according to Miller's algorithm and a step of performing exponentiation on the computation result.

With a digital group signature, when access right of an individual user belonging to a group is authenticated, a pairing computation is first performed for excluding an individual user whose access right expires. Then, with the digital group signature, an authentication process is performed through a pairing computation for a predetermined individual user, so that an attribute change such as issue or expiration of access right for each individual user is flexibly handled.

Then, for example, in a case of a digital group signature for a group consisting of 10,000 individual users, if there are 100 individual users whose access rights expire, 100 pairing computations are required. At present, one pairing computation by a general electronic calculator requires about 0.1 second. Accordingly, 100 pairing computations require about 10 seconds. Therefore, in the present situation, a digital group signature scheme is not deemed to be practical and has not been widely used.

In the present situation, in order to put digital group signatures into practical use, researches are focused on improving the speed of pairing computations. For example, a technique for achieving fast pairing computations proposes using Tate pairing computation defined over an elliptic curve to reduce the computation load (see, for example, Patent Document 1).

-   Patent Document 1: Japanese Patent Application Publication No.     2005-316267

DISCLOSURE OF INVENTION Problems to be Solved by the Invention

However, the currently proposed techniques for faster pairing computation have not yet been sufficient, and there has been a growing demand for further acceleration of computation.

In view of the present situation, the present inventors have conducted research and development to increase the pairing computation speed and have conceived the present invention.

Means for Solving the Problems

A pairing computation device according to the present invention is for defining pairing e by using:

G ₁ =E[r]∩Ker (φ_(p)−[1])), and

G ₂ =E[r]∩Ker(φ_(p) −[p]),

as a nondegenerate bilinear map:

e: G₂×G₁→F*_(p) ^(k)/(F*_(p) ^(k))^(r),

where:

-   E is an additive group of rational points on a pairable elliptic     curve defined over F_(p) ^(k) with an embedding degree of k, and the     curve equation is given by y²=x³+ax+b where a∈F_(p) and b∈F_(p), -   E[r] is a set of rational points of a prime order r, and -   φ_(p) is Frobenius endomorphism, -   computing pairing e(Q,S) where S∈G₁ and Q∈G₂, and outputting a     result of the computation. The pairing computation device includes,     where t is a trace of the Frobenius endomorphism φ_(p), instead of     computing the pairing e(Q,S) by using a rational function     f_(t−1,Q)(S) calculated according to Miller's algorithm as:

e(Q,S)=ƒ_(t−1.Q)(S)^((p) ^(k) ^(−1)/r), and   [Formula 2]

-   the order r and the trace t of the Frobenius endomorphism φ_(p) are     used as functions of an integer variable χ: -   computation means for computing a rational function f_(χ,Q)(S); -   computation means for computing a value of a rational point S(x_(s),     y_(s)) on a line passing through a predetermined rational point; -   computation means for computing a rational function f′_(χ,Q)(S)     using computation results of these computation means; and -   computation means for performing pairing computation by using the     rational function f′_(χ,Q)(S) as:

e(Q,S)=ƒ′_(χ,Q)(S)^((p) ^(k) ^(−1)/r).   [Formula 3]

The pairing computation device according to the present invention is characterized in that the computation means for computing the rational function f_(χ,Q)(S) includes computation means for computing χQ, storing a result of the computation in a predetermined register, and computing the predetermined rational point by using the result of the computation of χQ.

Furthermore, the pairing computation device according to the present invention is characterized in that, if the embedding degree k=12, using the integer variable χ, letting the order r and the trace t of the Frobenius endomorphism φ_(p) be:

r(χ)=36χ⁴−36χ³+18χ²−6χ+1,

t(χ)=6χ²+1,

-   letting χQ=R, using a relation of Frobenius endomorphism φ_(p) of R     being φ_(p)(R)=pR, rational points p¹⁰χQ, χQ+p¹⁰χQ, pχQ+p³χQ are     computed, -   a value l₁ of the rational point S(x_(s), y_(s)) on a line passing     through rational points (χQ, p¹⁰χQ) and a value l₂ of the rational     point S(x_(s), y_(s)) on a line passing through rational     points)(χQ+p¹⁰χQ, pχQ+p³χQ) are computed, and -   the rational function f′_(χ,Q)(S) is computed by using a value l₃ of     the rational point S(x_(s), y_(s)) on a line passing through     rational points (pχQ, p³χQ) as:

ƒ′_(χ,Q)(S)=ƒ_(χ,Q)(S)^(l+p+p) ³ ^(+p) ¹⁰ ·l ₁ ·l ₂ ·l ₃.   [Formula 4]

Moreover, the pairing computation device according to the present invention is characterized in that using Frobenius endomorphism φ_(p) of the rational function f_(χ,Q)(S) being φ_(p)(f_(χ,Q)(S))=f_(χ,Q)(S)^(p),

ƒ_(χ,Q)(S)^(l+p) ¹⁰ ·l₁ is computed, and   [Formula 5]

-   using Frobenius endomorphism φ_(p) of a value l of the rational     point S(x_(s), y_(s)) on a line passing through rational points (Q₁,     Q₂), Q₁,Q₂∈G₂, being a value of the rational point S(x_(s), y_(s))     on a line passing through rational points (pQ₁, pQ₂), the rational     function f′_(χ,Q)(S) is computed by computing:

ƒ_(χ,Q)(S)^(p+p) ³ ·l ₃ which satisfies:   [Formula 7]

ƒ_(χ,Q)(S)^(p+p) ³ ·l ₃=φ_(p) ³(ƒ_(χ,Q)(S)^(l+p) ¹⁰ ·l ₁).   [Formula 6]

A pairing computation method according to the present invention is for defining pairing e by using:

G ₁ =E[r]∩Ker(φ_(p)−[1]) , and

G ₂ =E[r]∩Ker(φ_(p) −[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_(p) ^(k)/(F*_(p) ^(k))^(r),

where:

-   E is an additive group of rational points on a pairable elliptic     curve defined over F_(p) ^(k) with an embedding degree of k, and the     curve equation is given by y²=x³+ax+b where a∈F_(p) and b∈F_(p), -   E[r] is a set of rational points of a prime order r, and -   φ_(p) is Frobenius endomorphism, and -   computing pairing e(Q,S) where S∈G₁ and Q∈G₂ by an electronic     calculator including a CPU. The pairing computation method includes     steps of, where t is a trace of the Frobenius endomorphism φ_(p),     instead of computing the pairing e(Q,S) by using a rational function     f_(t−1,Q)(S) calculated according to Miller's algorithm as:

e(Q,S)=ƒ_(t−1,Q)(S)^((p) ^(k) ^(−1)/r), and   [Formula 2]

-   the order r and the trace t of the Frobenius endomorphism φ_(p) are     used as functions of an integer variable χ: -   causing the CPU of the electronic calculator to function as     computation means for computing a rational function f_(χ,Q)(S); -   causing the CPU of the electronic calculator to function as     computation means for computing a value of a rational point S(x_(s),     y_(s)) on a line passing through a predetermined rational point; -   causing the CPU of the electronic calculator to function as     computation means for computing a rational function f′_(χ,Q)(S)     using results of the computations; and -   causing the CPU of the electronic calculator to function as     computation means for performing computation by using the rational     function f′_(χ,Q)(S) as:

e(Q,S)=ƒ′_(χ,Q)(S)^((p) ^(k) ^(−1)/r)   [Formula 3]

The pairing computation method according to the present invention is characterized by further including a step of causing the CPU of the electronic calculator to function as computation means for computing χQ and computing the predetermined rational point by using the result of the computation of χQ, after the step of computing the rational function f_(χ,Q)(S).

A pairing computation program according to the present invention is for defining pairing e by using:

G ₁ =E[r]∩Ker(φ_(p)−[1]), and

G ₂ =E[r]∩Ker(φ_(p) −[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_(p) ^(k)/(F*_(p) ^(k))^(r),

where:

-   E is an additive group of rational points on a pairable elliptic     curve defined over F_(p) ^(k) with an embedding degree of k, and the     curve equation is given by y²=x³+ax+b where a∈F_(p) and b∈F_(p), -   E[r] is a set of rational points of a prime order r, and -   φ_(p) is Frobenius endomorphism, and -   causing an electronic calculator including a CPU to compute pairing     e(Q,S) where S∈G₁ and Q∈G₂. The pairing computation program causes     the electronic calculator to function as, where t is a trace of the     Frobenius endomorphism φ_(p), instead of causing computation of the     pairing e(Q,S) by using a rational function f_(t−1,Q)(S) calculated     according to Miller's algorithm as:

e(Q,S)=ƒ_(t−1,Q)(S)^((p) ^(k) ^(−1)/r), and   [Formula 2]

-   the order r and the trace t of the Frobenius endomorphism φ_(p) are     used as functions of an integer variable χ: -   computation means for computing a rational function f_(χ,Q)(S); -   computation means for computing a value of a rational point S(x_(s),     y_(s)) on a line passing through a predetermined rational point; -   computation means for computing a rational function f′_(x,Q)(S)     using results of the computations; and -   computation means for performing computation by using the rational     function f′_(χ,Q)(S) as:

e(Q,S)=ƒ′_(χ,Q)(S)^((p) ^(k) ^(−1)/r).   [Formula 3]

The pairing computation program according to the present invention is characterized in that the program causes the electronic calculator to function as computation means for computing χQ and computation means for computing the predetermined rational point by using the result of the computation of χQ.

EFFECTS OF THE INVENTION

In accordance with the present invention, a rational function calculated according to Miller's algorithm in pairing computation is given as a function of an integer variable x, so that the rational function can be calculated at high speed, thereby achieving faster pairing computation. Therefore, it is possible to provide digital group signature service of practical use.

BRIEF DESCRIPTION OF THE DRAWINGS

[FIG. 1] is a schematic diagram of a pairing computation device according to an embodiment of the present invention.

[FIG. 2] is a flowchart of a pairing computation program according to the embodiment of the present invention.

[FIG. 3] is a flowchart for computing a rational function f_(χ,Q)(S).

[FIG. 4] is a flowchart of a pairing computation program according to another embodiment of the present invention.

DESCRIPTION OF THE REFERENCE SIGNS

-   10 electronic calculator -   11 CPU -   12 storage device -   13 memory device -   14 bus -   15 input/output control unit -   20 electrical communication line -   30 client device

BEST MODE(S) FOR CARRYING OUT THE INVENTION

A pairing computation device, a pairing computation method, and a pairing computation program according to the present invention perform pairing computation including a first step of computing a rational function according to Miller's algorithm and a second step of performing exponentiation on the computation result. In the first step, the pairing computation device, the pairing computation method, and the pairing computation program compute a rational function using an integer variable χ to speed up the computation.

Specifically, in the conventional pairing computation, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_(p)−[1]), and

G ₂ =E[r]∩Ker(φ_(p) −[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_(p) ^(k)/(F*_(p) ^(k))^(r),

where:

-   E is an additive group of rational points on a pairable elliptic     curve defined over F_(p) ^(k) with an embedding degree of k, and the     curve equation is given by y²=x³+ax+b where a∈F_(p) and b∈F_(p), -   E[r] is a set of rational points of a prime order r, and -   φ_(p) is Frobenius endomorphism, and -   pairing e(Q,S) is computed where S∈G₁ and Q∈G₂, and t is a trace of     the Frobenius endomorphism φ_(p), by using a rational function     f_(t−1,Q)(S) calculated according to Miller's algorithm by the     following formula known as Ate pairing:

e(Q,S)=ƒ_(t−1,Q)(S)^((p) ^(k) ^(−1)/r).   [Formula 2]

By contrast, the present inventors have found pairing that allows for faster computation by using an integer variable χ on an elliptic curve. This pairing is referred to as “Xate pairing.”

In other words, the pairing computation device, the pairing computation method, and the pairing computation program according to the present invention use Xate pairing rather than Ate pairing, thereby enabling fast computation.

In particular, the elliptic curves used in pairing computation are known as pairing-friendly curves corresponding to the respective embedding degrees. For example, with an embedding degree k=12, the order r and the trace t of the Frobenius endomorphism φ_(p) are known to be represented as follows using the integer variable χ:

r(χ)=36χ⁴−36χ³+18χ²−6χ+1,

t(χ)=6χ²+1.

With an embedding degree k=10, r and t are known to be represented as follows:

r(χ)=25χ⁴+25χ³+15χ²+5χ+1,

t(χ)=10χ²+5χ+3.

Alternatively, they are also known to be represented as follows:

r(χ)=χ⁸−1,

t(χ)=−χ⁶+χ⁴−χ²+2.

With an embedding degree k=8, r and t are known to be represented as follows:

r(χ)=9χ⁴+12χ³+8χ²+4χ+1,

t(χ)=−9χ³−3χ²−2χ.

Alternatively, they are also known to be represented as follows:

r(χ)=χ⁴−8χ²+25,

t(χ)=(2χ³−11χ+15)/15.

Alternatively, they are also known to be represented as follows:

r(χ)=χ⁸−χ⁴+1,

t(χ)=χ⁵−χ+1.

With an embedding degree k=18, r and t are known to be represented as follows:

r(χ)=(χ⁶+37χ³+343)/343,

t(χ)=(χ⁴+16χ+7)/7.

In the following, Xate pairing will be described with the embedding degree k=12, by way of example.

With the embedding degree k=12, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_(p)−[1]), and

G ₂ =E[r]∩Ker(φ_(p) −[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_(p) ¹²/(F*_(p) ¹²)^(r)

where:

t is an additive group of rational points on a pairable elliptic curve defined over F_(p) ¹², and the curve equation is given by y²=x³+b where b∈F_(p), E[r] is a set of rational points of a prime order r, and φ_(p) is Frobenius endomorphism.

In this case, the order r and the trace t of the Frobenius Endomorphism φ_(p) can be represented as follows using the integer variable χ as described above.

r(χ)=36χ⁴−36χ³+18χ²−6χ+1   (Equasion 1)

t(χ)=6χ²+1   (Equasion 2)

Equasion 2 can be transformed as follows. Here, the notation (χ) will be omitted unless particularly necessary, for the sake of convenience.

6χ² ≡t−1≡p (mod r)   (Equasion 3)

Here, a characteristic p has the following relational expression.

p=r+t−1   (Equasion 4)

Therefore, the characteristic p is represented as follows using the integer variable χ.

p(χ)=36χ⁴−36χ³+24χ²−6χ+1   (Equasion 5)

Using Equasion 3, Equasion 5 can be transformed as follows.

p≡p ²−6χ(p+1)+4p+1 (mod r)   (Equation 6)

Equasion 6 can be transformed as follows.

6χ(1+p)≡p ²+3p+1 (mod r)   (Equasion 7)

Here, based on the already-known relational expression p⁴−p²+1≡0 (mod r), the following equation is obtained.

p ²(1−p)(1+p)≡1 (mod r)   (Equasion 8)

Equasion 8 can be transformed as follows.

(1+p)⁻¹ ≡p ² (1−p) (mod r)   (Equasion 9)

Using Equasion 9 and from the relational expression p⁶≡−1 (mod r), Equasion 7 can be transformed as follows.

$\begin{matrix} \begin{matrix} {{6\chi} \equiv {\left( {1 + p} \right)^{- 1}\left\{ {\left( {1 + p} \right)^{2} + p} \right\}}} \\ {\equiv {1 + p + p^{3} + {p^{10}\mspace{14mu} \left( {{mod}\mspace{14mu} r} \right)}}} \end{matrix} & \left( {{Equasion}\mspace{14mu} 10} \right) \end{matrix}$

Next, a rational function f_(t−1,Q)(·) of Ate pairing will be considered. In particular, with Equasion 3, the rational function f_(t−1,Q)( ) can be represented as follows, where t−1=T:

[Formula 8 ]

ƒ_(6χ) ₂ _(,Q)=ƒT,Q   (Equasion 11).

Here, Q∈G₂, and for ∀S∈G₁, the following equation is given:

[Formula 9]

ƒ_(6χ) ₂ _(,Q)(S)^((p) ¹² ^(−1)/r)=ƒ_(T,Q)(S)^((p) ¹² ^(−1)/r)=α(Q,S)   (Equasion 12).

Using Equasion 10, the following equation is obtained:

[Formula 10]

ƒ_(6χ) ₂ _(,Q)=ƒ_(6χ·χ,Q)=ƒ₍1+p+p ₃ _(+p) ₁₀ )χ,Q   (Equation 13).

Here, it is supposed that the rational function satisfies the following relational expressions:

[Formula 11]

ƒ_(a+b,Q)=ƒ_(a,Q)·ƒ_(b,Q) ·g _(aQ,bQ)   (Equasion 14),

[Formula 12]

ƒ_(ab,Q)=ƒ_(b,Q) ^(a)·ƒ_(a,bQ)=ƒ_(a,Q) ^(b)ƒ_(b,aQ)   (Equasion 15),

and

[Formula 13]

ƒ_(p) _(i) _(,Q)=ƒ_(p,Q) ^(ip) ^(i−1)   (Equasion 16).

Therefore, Equasion 13 can be transformed as follows:

[Formula 14]

ƒ_((1+p+p) ₃ _(+p) ₁₀ _()χ,Q)=ƒ_(χ, Q)·ƒ_(χ,Q) ^(p) ·g _(χQ,pχQ)·ƒ_(χ,Q) ^(p) ¹⁰ ·g _(p) ₃ _(χQ,p) ₁₀ _(χQ) g _(χQ+pχQ,p) ₃ _(χQ+p) ₁₀ _(χQ)·ƒ_(p,χQ) ^(l+3p) ² ^(+10p) ⁹   (Equasion 17).

Here, g_(aQ,bQ)=l_(aQ,bQ)/v_(aQ+bQ) where l_(aQ,bQ) denotes a value on the line passing through two rational points aQ and bQ, and v_(aQ+bQ) denotes a value on the vertical line of rational point aQ+bQ. When the embedding degree is an even number, the computation of V_(aQ+bQ) can be omitted.

Furthermore, in Equasion 17,

[Formula 15]

ƒ_(p,χQ) ^(l+3p) ² ^(+10p) ⁹   (Equasion 18)

has bilinearity and can be transformed as follows:

[Formula 16]

ƒ_(p,Q) ^(χ(1+3p) ² ^(+10p) ⁹ )   (Equasion 19).

Therefore, using Equasion 3, Equasion 13, and Equasion 19, the transformation of Equasion 17 results in the following.

[Formula 17]

ƒ_(p,Q)·{ƒ_(p,Q) ^(χ(1+3p) ² ^(+10p) ⁹ ⁾}⁻¹=ƒ_(χ,Q)·ƒ_(χ,Q) ^(p) ·g _(χQ,pχQ)·ƒ_(χ,Q) ^(p) ³ ·ƒ_(χ,Q) ^(p) ¹⁰ ·g _(p) ₃ _(χ,Q,p) ₁₀ _(χQ) ·g _(χQ+pχQ,p) ₃ _(χQ+p) ₁₀ _(χQ)   (Equasion 20).

Here, given that the left side of Equasion 20 has bilinearity, the present inventors have noticed that the right side of Equasion 20 has also bilinearity and set the right side of Equasion 20 as a new rational function f′_(χ,Q)(·).

More specifically, the computation of pairing e(Q,S) is carried out by the following equation:

e(Q,S)=ƒ′_(χ,Q)(S)^((p) ¹² ^(−1)/r).   [Formula 18]

The present inventors call this pairing e(Q,S) as Xate pairing.

Furthermore, the right side of Equasion 20 can be transformed as follows:

[Formula 19]

ƒ_(χ,Q) ^(l+p+p) ³ ^(+p) ¹⁰ ·g _(χQ,p) ₁₀ _(χQ) ·g _(pχQ,p) ₃ _(χQ) ·g _(χQ+p) ₁₀ _(χQ,pχQ+p) ₃ _(χQ)   (Equasion 21).

In other words, in the case of the embedding degree k=12, if a value l₁ of a rational point S(x_(s), y_(s)) on a line passing through rational points (χQ, p¹⁰χQ), a value l₂ of a rational point S(x_(s), y_(s)) on a line passing through rational points (χQ+p¹⁰χQ, pχQ+p³χQ), and a value l₃ of a rational point S(x_(s), y_(s)) on a line passing through rational points (pχQ, p³χQ) are calculated and specified, the computation according to Miller's algorithm can be speeded up based on the following equation:

ƒ′_(χ, Q)(S)=ƒ_(χ,Q)(S)^(l+p+p) ³ ^(+p) ¹⁰ ·l ₁ ·l ₂ ·l ₃.   [Formula 4]

Moreover, the right side of Equasion 20 can be transformed as follows, which makes the computation of f′_(χ,Q)(S) even faster:

[Formula 20]

{ƒ_(χ,Q) ^(l+p) ¹⁰ ·g _(χQ,p) ₁₀ _(χQ)}^(l+p) ³ ·g _(χQ+p) ₁₀ _(χQ,pχQ+p) ₃ _(χQ)   (Equasion 22).

As described above, if pairing computation is carried out using Xate pairing, the computation can be performed using the rational function f_(χ,Q)(S) and a new rational function f′_(χ,Q)(S) obtained by using the values on the lines passing through predetermined rational points. In particular, the rational function f′_(χ,Q)(S) can be computed using χ having a size smaller than t−1, thereby achieving faster pairing computation.

The description has been given so far to the case of the embedding degree k=12. This is basically applicable to the cases of the embedding degrees k=8, 10, 18, and therefore, a detailed description thereof will not be repeated.

In the following, an embodiment with embedding degree k=12 will be detailed. It is noted that the present embodiment is intended for digital group signatures, and an authentication server configured with a predetermined electronic calculator is assumed as the pairing computation device. However, the pairing computation device may not be configured as an authentication server and may be any device as long as it includes at least computing means such as CPU and can perform pairing computation.

As shown in FIG. 1, an electronic calculator 10 which configures an authentication server includes a CPU 11 for performing computation, a storage device 12 such as a hard disk for storing a variety of programs such as a pairing computation program and data for use in the pairing computation program, and a memory device 13 configured with a RAM, for example, for expanding the pairing computation program so as to be executable and for temporarily storing data generated by execution of the pairing computation program. FIG. 4 also shows a bus 14.

The electronic calculator 10 is also connected to an electrical communication line 20 such as the Internet so as to be able to receive signature data of a digital group signature transmitted from a client device 30 connected to the electrical communication line 20. FIG. 1 shows that the electronic calculator 10 includes an input/output control unit 15.

When signature data of a digital group signature is transmitted from the client device 30 to the electronic calculator 10, the transmitted signature data is temporarily stored in the memory device 13. Then, the electronic calculator 10 performs pairing computation by executing the pairing computation program.

More specifically, upon execution of the pairing computation program, the electronic calculator 10 performs pairing computation based on a flowchart shown in FIG. 2 to implement a digital group signature. It is noted that the authentication process in the digital group signature will not be detailed, and only the pairing computation as a subroutine in the authentication process will be detailed.

With the pairing computation program, the CPU 11 of the electronic calculator 10 functions as input means for inputting required data in step S1 as shown in FIG. 2. More specifically, in the electronic calculator 10, data of an integer variable χ and data of a rational point Q stored beforehand in the memory device 13 are input in a predetermined register provided inside the CPU 11, and in addition, data of a rational point S temporarily stored as signature data in the memory device 13 is input in a predetermined register provided inside the CPU 11.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as first computation means for performing computation of a rational function f_(χ,Q)(S) by Miller's algorithm, in step S2.

Specifically, the computation of the rational function f_(χ,Q)(S) is executed as shown in a flowchart in FIG. 3. In particular, in step S2, the computation of χQ is performed along with the computation of the rational function f_(χ,Q)(S), and the result of the computation of χQ is stored in a predetermined register provided inside the CPU 11.

More specifically, based on the flowchart in FIG. 3, the electronic calculator 10 performs initial settings in step S21. More specifically, the electronic calculator 10 performs an operation to set f←1, T←Q, and i←[log₂(χ)], where i is the number of bits if the integer variable x is in binary representation.

Then, based on the flowchart in FIG. 3, the electronic calculator 10 performs a predetermined computation for the rational function f_(χ,Q)(S) part, in step S22.

Then, based on the flowchart in FIG. 3, the electronic calculator 10 performs a predetermined computation for the χQ part, in step S23.

Then, based on the flowchart in FIG. 3, the electronic calculator 10 determines whether value u_(i) of the i-th bit of the integer variable χ is “1” or “0”, in step S24.

If u_(i)=1, based on the flowchart in FIG. 3, the electronic calculator 10 performs a predetermined computation for the rational function f_(χ,Q)(S) part, in step S25, and then performs a predetermined computation for the χQ part, in step S26.

Then, based on the flowchart in FIG. 3, the electronic calculator 10 performs a termination determination, in step S27.

If i≠1 in step S27, based on the flowchart in FIG. 3, the electronic calculator 10 decrements i in step S28, and then, returning to step S22, repeatedly performs the computations of the rational functions f_(χ,Q)(S) and χQ until i=1 in step S27.

If i=1 in step S27, the electronic calculator 10 stores the computation result of the rational function f_(χ,Q)(S) and the computation result of χQ in predetermined registers and then ends the subroutine based on the flowchart in FIG. 3.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as second computation means for computing rational points p¹⁰χQ, χQ+p¹⁰χQ, pχQ+p³χQ, in step S3.

In particular, in the second computation means, letting χQ stored in the predetermined register in step S2=R, using the relation of Frobenius endomorphism φ_(p) of R being φ_(p)(R)=pR, computation is performed by assuming that the rational points are p¹⁰χQ=p¹⁰R, χQ+p¹⁰χQ=R+p¹⁰R, pχQ+p³χQ=pR+p³R.

Specifically, given T=χQ=R where X=p¹⁰R, Y=R+p¹⁰R, Z=pR+p³R, the electronic calculator 10 performs computation as follows:

X←φ_(p) ¹⁰(T),

Y←T+X, and

Z←φ_(p) ³(Y).

Therefore, since the electronic calculator 10 can perform computation without performing a multiplication process in step S3, the computation can be speeded up.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as third computation means for computing the value l₁ of the rational point S(x_(s), y_(s)) on the line passing through the rational points (χQ, p¹⁰χQ) and the value l₂ of the rational point S(x_(s), y_(s)) on the line passing through the rational points (χQ+p¹⁰χQ, pχQ+p³χQ), in step S4.

Specifically, in the electronic calculator 10, l₁=l_(T,X)(S) is computed as follows:

λ_(T,X)←(y_(X)−y_(T))/(x_(X)−x_(T)), and

l_(T,X)(S)←(x_(S)−x_(X)) λ_(T,X)−(y_(S)-y_(X)).

Furthermore, in the electronic calculator 10, l₂=l_(Y,Z)(S) is computed as follows:

λ_(Y,Z)←(y_(Z)−y_(Y))/(x_(Z)−x_(Y)), and

l_(Y,Z)(S)←(x_(S)−x_(Z)) λ_(Y,Z)−(y_(S)−y_(Z)).

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as fourth computation means for computing, using the computation result in the first computation means, the computation result in the third computation means, and the value l₃ of the rational point S(x_(s), y_(s)) on the line passing through the rational points (pχQ, p³χQ), a rational function f′_(χ,Q)(S) as follows, in step S5:

ƒ═_(χ,Q)(S)=ƒ_(χ,Q)(S)^(l+p+p) ³ ^(+p) ¹⁰ ·l ₁ ·l ₂ ·l ₃.   [Formula 4]

In particular, in this case, given that Frobenius endomorphism φ_(p) of the rational function f_(χ,Q)(S) is χ_(p)(f_(χ,Q)(S))=f_(χ,Q)(S)^(p), using φ_(p) ¹⁰(f_(χ,Q)(S))=f_(χ,Q)(S)^(p{circumflex over (0)}10) (here, p^({circumflex over (0)}10) represents p¹⁰), the electronic calculator 10 computes:

ƒ_(χ,Q)(S)^(l+p) ¹⁰ ·l₁.   [Formula 5]

Furthermore, using Frobenius endomorphism φ_(p) of a value l of a rational point S(x_(s), y_(s)) on a line passing through rational points (Q₁, Q₂), Q₁, Q₂∈G₂, being a value of a rational point S(x_(s), y_(s)) on a line passing through rational points (pQ₁, pQ₂), the electronic calculator 10 computes a rational function f′_(χ,Q)(S) by computing:

ƒ_(χ,Q)(S)^(p+p) ³ ·l₃ which satisfies:   [Formula 6]

ƒ_(χ,Q)(S)^(p+p) ³ ·l ₃−φ_(p) ³(ƒ_(χ,Q)(S)^(l+p) ¹⁰ ·l ₁).   [Formula 6]

Specifically, the electronic calculator 10 performs computation as follows. Here, p^({circumflex over (0)}3) represents p³.

-   1. C←f^(p{circumflex over (0)}10) -   2. C←C·f -   3. A←C·l_(T,X)(S) -   4. B←A^(p{circumflex over (0)}3) -   5. return A,B

Therefore,

ƒ′_(χ,Q)(S)=ƒ_(χ,Q)(S)^(l+p+p) ³ ^(+p) ¹⁰ ·l ₁ ·l ₂ ·l ₃   [Formula 4]

can be calculated as:

f′←A·B·l_(Y,Z)(S).

In this manner, the use of Xate pairing can significantly reduce the computation amount thereby achieving faster pairing computation.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as fifth computation means for performing final exponentiation in the pairing e(Q,S) in step S6.

Specifically, the electronic calculator 10 performs computation as follows.

-   1. f′←f′^(p{circumflex over (0)}6)·f′⁻¹ -   2. f′←f′^(p̂2)·f′ -   3. a←(f′⁶)^(χ)·(f′⁵)^(p{circumflex over (0)}6) -   4. b←a^(p) -   5. b←a·b -   6. compute f′^(p),f′^(p{circumflex over (0)}2), and f′^(p̂3) -   7. c←b·(f′^(p))²·f′^(p{circumflex over (0)}2) -   8. f′←f′^(p{circumflex over (0)}3)·(c⁶)^(χ{circumflex over (0)}2)·c     b·(f′^(p)·f′)⁹·a·f′⁴ -   9. Return f′

In the electronic calculator 10 that configures an authentication server, an authentication process is performed using the result of pairing computation obtained as described above.

In the present embodiment, the description has been made to the case of the embedding degree k=12. However, for example, in the case of an embedding degree k=10, similar computation can also be performed.

With the embedding degree k=10, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_(p)−[1]), and

G ₂ =E[r]∩Ker(φ_(p) −[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_(p) ¹⁰/(F*_(p) ¹⁰)^(r)

where:

-   E is an additive group of rational points on a pairable elliptic     curve defined over F_(p) ¹⁰ with an embedding degree of 10, and the     curve equation is given by y²=x³+ax+b where a∈F_(p) and b∈F_(p),     E[r] is a set of rational points of a prime order r, and φ_(p) is     Frobenius endomorphism.

In this case, the order r and the trace t of the Frobenius endomorphism φ_(p) are represented as follows, using an integer variable χ.

r(χ)=25χ⁴+25χ³+15χ²+5χ+1

t(χ)=10χ²+5χ+3

Furthermore, p-adic expansion by a characteristic p of the integer variable χ is represented as follows.

5χ=p ⁴ +p ⁵ +p ⁷ +p ⁸ =p ⁴(1+p+p ³ +p ⁴) (mod r(χ))

Then, a value l₄ of a rational point S(x_(s), y_(s)) on a line passing through rational points (χQ, pχQ) and a value l₅ of a rational point S(x_(s), y_(s)) on a line passing through rational points (χQ+pχQ, p³χQ+p⁴χQ) are computed, and then using a value l₆ of a rational point S(x_(s), y_(s)) on a line passing through rational points (p³χQ, p⁴χQ), a rational function f′_(χ,Q)(S) is computed by the following equation:

ƒ′_(χ,Q)(S)=φ_(p) ⁴(ƒ_(χ,Q)(S)^(l+p+p) ³ ^(+p) ⁴ ·l ₄ ·l ₅ ·l ₆).   [Formula 21]

Similarly to the case of the embedding degree k=12, also in the case of the embedding degree k=10, the authentication server performs pairing computation based on a flowchart shown in FIG. 4 by executing the pairing computation program.

With the pairing computation program, as shown in FIG. 4, in step T1, the CPU 11 of the electronic calculator 10 functions as input means for inputting required data. More specifically, in the electronic calculator 10, data of the integer variable χ and data of the rational point Q stored beforehand in the memory device 13 are input in a predetermined register provided inside the CPU 11, and in addition, data of the rational point S temporarily stored as signature data in the memory device 13 is input in a predetermined register provided inside the CPU 11.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the first computation means for performing computation of a rational function f_(χ,Q)(S) by Miller's algorithm, in step T2.

It is noted that in this step T2, the first equation in step S22 in the flowchart shown in FIG. 3 is given as follows.

λ_(T,T)←(3x _(T) ² +a)/(2y _(T))   1.

Here, “a” denotes the first-order coefficient in the elliptic curve given by y²=x³+ax+b where a∈F_(p) and b∈F_(p). Except for this first equation, computation of the rational function f_(χ,Q)(S) is performed similarly to the flowchart shown in FIG. 3.

Furthermore, in step T2, the electronic calculator 10 also computes χQ along with the rational function f_(χ,Q)(S) and stores the computation result in a predetermined register.

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the second computation means for computing rational points pχQ, χQ+pχQ, p³χQ+p⁴χQ in step T3.

In particular, in the second computation means, letting χQ stored in the predetermined register in step T2=R, using the relation of Frobenius endomorphism φ_(p) of R being φ_(p)(R)=pR, computation is performed by assuming that the rational points are pχQ=pR, χQ+pχQ=R+pR, p³χQ+p⁴χQ=p³R+p⁴R.

Specifically, given T=χQ=R where X=pR, Y=R+pR, Z=p³R+p⁴R, the electronic calculator 10 performs computation as follows:

X←φ_(p)(T),

Y←+X, and

Z←φ_(p) ³(Y).

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the third computation means for computing the value l₄ of the rational point S(x_(s), y_(s)) on the line passing through the rational points (χQ, pχQ) and the value l₅ of the rational point S(x_(s), y_(s)) on the line passing through the rational points (χQ+pχQ, p³χQ+p⁴χQ), in step T4.

Specifically, in the electronic calculator 10, l₄=l_(T,X)(S) is computed as follows:

λ_(T,X)←(y_(X)−y_(T))/(x_(X)−x_(T)),

l_(T,X)(S)←(x_(S)−x_(X))λ_(T,X)−(y_(S)−y_(X)).

Furthermore, in the electronic calculator 10, l₅=l_(Y,Z)(S) is computed as follows:

λ_(Y,Z)←(y_(Z)−y_(Y))/(x_(Z)−x_(Y)),

l_(T,Z) (S)←(x_(S)−x_(Z)) λ_(Y,Z)−(y_(S)−y_(Z)).

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the fourth computation means for computing, using the computation result in the first computation means, the computation result in the third computation means, and the value l₆ of the rational point S(x_(s), y_(s)) on the line passing through rational points (p³χQ, p⁴χQ), a rational function f′_(χ,Q)(S) as follows, in step T5:

ƒ′_(χ,Q)(S)=φ_(p) ⁴(ƒ_(χ,Q)(S)^(l+p+p) ³ ^(+p) ⁴ ·l ₄ ·l ₅ ·l ₆).   [Formula 21]

In particular, in this case, using Frobenius endomorphism φ_(p) of the rational function f_(χ,Q)(S) being φ_(p)(f_(χ,Q)(S))=f_(χ,Q)(S)^(p), the electronic calculator 10 computes:

ƒ_(χ,Q)(S)^(l+p)·l₄.   [Formula 22]

Furthermore, using Frobenius endomorphism φ_(p) of the value l of the rational point S(x_(s), y_(s)) on the line passing through the rational points (Q₁, Q₂), Q₁,Q₂∈G₂, being a value of the rational point S(x_(s), y_(s)) on a line passing through the rational points (pQ₁, pQ₂), the electronic calculator 10 computes a rational function f′_(χ,Q)(S) by computing:

ƒ_(χ,Q)(S)^(p) ³ ^(+p) ⁴ ·l₆ which satisfies:   [Formula 24]

ƒ_(χ,Q)(S)^(p) ³ ^(+p) ⁴ ·l ₆=φ_(p) ³(ƒ_(χ,Q)(S)^(l+p) ·l ₄).   [Formula 23]

Specifically, the electronic calculator 10 performs computation as follows. Here, p^({circumflex over (0)}3) represents p³.

-   1. C←f^(p) -   2. C←C·f -   3. A←C·l_(T,X)(S) -   4. B←A^(p{circumflex over (0)}3) -   5. return A,B

Furthermore, the electronic calculator 10 performs computation as:

-   1. f′←A B·l_(Y,Z)(S) -   2. f′←f′^(p{circumflex over (0)}4)     thereby computing:

ƒ′_(χ,Q)(S)=φ_(p) ⁴(ƒ_(χ,Q)(S)^(l+p+p) ³ ^(+p) ⁴ ·l ₄ ·l ₅ ·l ₆).   [Formula 21]

Then, with the pairing computation program, the CPU 11 of the electronic calculator 10 functions as the fifth computation means for performing final exponentiation in the pairing e(Q,S) in step T6.

In the electronic calculator 10 that configures an authentication server, an authentication process is performed using the result of pairing computation obtained as described above.

Furthermore, in the case of the embedding degree k=10, letting the rational function calculated according to Miller's algorithm be given by f_(χ{circumflex over (0)}2,Q)(S) (χ^({circumflex over (0)}2) represents χ²), pairing e(Q,S) can also be computed.

In this case, the order r and the trace t of the Frobenius endomorphism φ_(p) is represented as follows, using an integer variable χ.

r(χ)=χ⁸−1

t(χ)=−χ⁶+χ⁴−χ²+2

Furthermore, p-adic expansion by a characteristic p of the integer variable χ is represented as follows.

pχ ²=−p (mod r(χ))

Then, the electronic calculator 10 computes a rational function f′_(χ,Q)(S) by the following equation:

ƒ′_(χ,Q)(S)=ƒ_(χ) ₂ _(,Q)(S)^(p)   [Formula 25]

Therefore, according to the pairing computation program, in the electronic calculator 10, the pairing e(Q,S) can be computed as:

e(Q,S)=ƒ′_(χ,Q)(S)^((p) ¹⁰ ^(−1)/r).   [Formula 26]

With the embedding degree k=8, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_(p)−[1]), and

G ₂ =E[r]∩Ker(φ_(p) −[p]),

as a nondegenerate bilinear map:

e:G₂×G₁→F*_(p) ⁸/(F*_(p) ⁸)^(r)

where:

-   E is an additive group of rational points on a pairable elliptic     curve defined over F_(p) ⁸, and the curve equation is given by     y²=x³+ax where a∈F_(p), E[r] is a set of rational points of a prime     order r, and φ_(p) is the Frobenius endomorphism.

In this case, the order r and the trace t of Frobenius endomorphism φ_(p) are represented as follows, using an integer variable χ.

r(χ)=9χ⁴+12χ³+8χ²+4χ+1

t(χ)=−9χ³−3χ²−2χ

Furthermore, p-adic expansion by a characteristic p of the integer variable χ is represented as follows.

3χ=−l−p ² +p ³ (mod r(χ))

Then, using a value l₇ of a rational point S(x_(s), y_(s)) on a line passing through rational points (χQ, χQ), a value l₈ of a rational point S(x_(s), y_(s)) on a line passing through rational points (2χQ, χQ), a value l₉ of a rational point S(x_(s), y_(s)) on a line passing through rational points (p²Q, (3χ+1)Q), and a value l₁₀ of a rational point S(x_(s), y_(s)) on a line passing through rational points (3χQ, Q), the electronic calculator 10 computes a rational function f′_(χ,Q)(S) using the following equation:

ƒ′_(χ,Q)(S)=ƒ_(χ,Q)(S)³ ·l ₇ ·l ₈ ·l ₉ ˜l ₁₀.   [Formula 27 ]

In other words, with the pairing computation program, the electronic calculator 10 performs computation of the rational function f_(χ,Q)(S) by Miller's algorithm as described above, computes χQ along with the rational function f_(χ,Q)(S), and then stores the computation result in a predetermined register.

Then, letting χQ stored in a predetermined register =R, using the relation of Frobenius endomorphism φ_(p) of R being φ_(p)(R)=pR, the electronic calculator 10 computes rational points 2χQ, p²χ, 3χQ, (3χ+1)Q, computes the values l₇, l₈, l₉, l₁₀ using the computation result, and computes the rational function f′_(χ,Q)(S).

Then, in the electronic calculator 10, the pairing e(Q,S) can be computed as:

e(Q,S)=ƒ′_(χ,Q)(S)^((p) ⁸ ^(−1)/r).   [Formula 28]

It is noted that, in the case of the embedding degree k=8, the order r and the trace t of the Frobenius endomorphism φ_(p) may also be represented as follows, using the integer variable χ.

r(χ)=χ⁴−8χ²+25

t(χ)=(2χ³−11χ+15)/15

In this case, p-adic expansion by the characteristic p of the integer variable χ is represented as follows.

χ=−p+2p ³ (mod r(χ))

In this case, using a value l₁₁ of a rational point S(x_(s), y_(s)) on a line passing through rational points (pQ, χQ), the rational function f′_(χ,Q)(S) can also be computed by the following equation:

ƒ′_(χ,Q)(S)=ƒ_(χ,Q)(S)·l ₁₁.   [Formula 29]

Alternatively, in the case of the embedding degree k=8, letting the rational functions calculated according to Miller's algorithm be given by f_(χ{circumflex over (0)}2,Q)(S) (χ^({circumflex over (0)}2) represents χ²) and f_(χ,Q)(S), the pairing e(Q,S) can also be computed.

Here, the order r and the trace t of the Frobenius endomorphism φ_(p) can also be represented as follows, using the integer variable χ.

r(χ)=χ⁸−χ⁴+1

t(χ)=χ⁵−χ+1

In this case, p-adic expansion by the characteristic p of the integer variable χ is represented as follows.

Pχ+χ ² =−o ² (mod r(χ))

In this case, using a value l₁₂ of a rational point S(x_(s), y_(s)) on a line passing through rational points (χ²Q, pχQ), the rational function f′_(χ,Q)(S) can be computed by the following equation:

ƒ′_(χ,Q)(S)=ƒ_(χ) ₂ _(,Q)(S)·ƒ_(χ,Q)(S)^(p) ·l ₁₂.   [Formula 30]

Here, the electronic computation device 10 computes χQ, along with the computation of the rational function f_(χ{circumflex over (0)}2,Q)(S) and the rational function f_(χ,Q)(S) by Miller's algorithm as described above, and stores the computation result in a predetermined register.

Then, letting χQ stored in a predetermined register=R, using the relation of Frobenius endomorphism φ_(p) of R being φ_(p)(R)=pR, the electronic calculator 10 computes a rational point pχQ, and computes the above-noted value l₁₂ using this computation result, and computes the rational function f′_(χ,Q)(S). Then, the pairing e(Q,S) can be computed as:

e(Q,S)=ƒ′_(χ,Q)(S)^((p) ⁸ ^(−1)/r).   [Formula 28]

With the embedding degree k=18, pairing e is defined by using:

G ₁ =E[r]∩Ker(φ_(p)−1]), and

G ₂ =E[r]∩Ker(φ_(p) −[p]),

as a nondegenerate bilinear map:

e:G₂×G₁←F*_(p) ¹⁸/(F*_(p) ¹⁸)^(r)

where:

-   E is an additive group of rational points on a pairable elliptic     curve defined over F_(p) ¹⁸, and the curve equation is given by     y²=x³+b where b∈F_(p), E[r] is a set of rational points of a prime     order r, and φ_(p) is Frobenius endomorphism.

In this case, the order r and the trace t of the Frobenius endomorphism φ_(p) are represented as follows, using an integer variable χ.

r(χ)=(χ⁶+37χ³+343)/343

t(χ)=(χ⁴+16χ+7)/7

In this case, p-adic expansion by a characteristic p of the integer variable χ is represented as follows.

χ=−3p+p ⁴ (mod r(χ))

Then, a value l₁₃ of a rational point S(x_(s), y_(s)) on a line passing through rational points (3pQ, χQ), the electronic calculator 10 computes a rational function f′_(χ,Q)(S) by the following equation:

ƒ′_(χ,Q)(S)=ƒ_(χ,Q)(S)·l ₁₃.   [Formula 31]

In other words, with the pairing computation program, the electronic calculator 10 performs computation of the rational function f_(χ,Q)(S) by Miller's algorithm as described above, computes χQ together with the rational function f_(χ,Q)(S), and then stores the computation result in a predetermined register.

Then, the electronic calculator 10 computes the above-noted value l₁₃ using the rational function f_(χ,Q)(S) and the computation result of χQ, and computes the rational function f′_(χ,Q)(S). Then, the pairing e(Q,S) can be computed as:

e(Q,S)=ƒ′_(χ,Q)(S)^((p) ¹⁸ ^(−1)/r).   [Formula 32]

As described above, pairing computation is performed with Xate pairing to achieve faster pairing computation, thereby making group signatures using pairing computation into practical use.

INDUSTRIAL APPLICABILITY

In accordance with the present invention, it is possible to provide a high-speed pairing computation device and to provide digital group signature service of practical use. 

1. A pairing computation device for defining pairing e by using: G ₁ =E[r]∩Ker(φ_(p)−[1]), and G ₂ =E[r]∩Ker(φ_(p) −[p]), as a nondegenerate bilinear map: e:G₂×G₁→F*_(p) ^(k)/(F*_(p) ^(k))^(r), where: E is an additive group of rational points on a pairable elliptic curve defined over F_(p) ^(k) with an embedding degree of k, and the curve equation is given by y²=x³+ax+b where a∈F_(p) and b∈F_(p), E[r] is a set of rational points of a prime order r, and φ_(p) is Frobenius endomorphism, computing pairing e(Q,S) where S∈G₁ and Q∈G₂, and outputting a result of the computation, the pairing computation device comprising, where t is a trace of the Frobenius endomorphism φ_(p), instead of computing the pairing e(Q,S) by using a rational function f_(t−1,Q)(S) calculated according to Miller's algorithm as: e(Q,S)=ƒ_(t−1,Q)(S)^((p) ^(k) ^(−1)/r), and   [Formula 2] the order r and the trace t of the Frobenius endomorphism φ_(p) are used as functions of an integer variable χ: computation means for computing a rational function f_(χ,Q)(S); computation means for computing a value of a rational point S(x_(s), y_(s)) on a line passing through a predetermined rational point; computation means for computing a rational function f′_(χ,Q)(S) using computation results of these computation means; and computation means for performing pairing computation by using the rational function f′_(χ,Q)(S) as: e(Q,S)=ƒ′_(χ,Q)(S)^((p) ^(k) ^(−1)/r).   [Formula 3]
 2. The pairing computation device according to claim 1, wherein the computation means for computing the rational function f_(χ,Q)(S) includes computation means for computing χQ, storing a result of the computation in a predetermined register, and computing the predetermined rational point by using the result of the computation of χQ.
 3. The pairing computation device according to claim 2, wherein, if the embedding degree k=12, using the integer variable χ, letting the order r and the trace t of the Frobenius endomorphism φ_(p) be: r(χ)=36χ⁴−36χ²+18χ²−6χ+1, t(χ)=6χ²+1, letting χQ=R, using a relation of Frobenius endomorphism φ_(p) of R being φ_(p)(R)=pR, rational points p¹⁰χQ, χQ+p¹⁰χQ, pχQ+p³χQ are computed, a value l₁ of the rational point S(x_(s), y_(s)) on a line passing through rational points (χQ, p¹⁰χQ) and a value l₂ of the rational point S (x_(s), y_(s)) on a line passing through rational points (χQ+p¹⁰χQ, pχQ+p³χQ) are computed, and the rational function f′_(χ,Q)(S) is computed by using a value l₃ of the rational point S(x_(s), y_(s)) on a line passing through rational points (pχQ, p³χQ) as: ƒ′_(χ,Q)(S)=ƒ_(χ,Q)(S)^(l+p+p) ³ ^(+p) ¹⁰ ·l ₁ l ₂ l ₃.   [Formula 4]
 4. The pairing computation device according to claim 3, wherein using Frobenius endomorphism φ_(p) of the rational function f_(χ,Q)(S) being φ_(p)(f_(χ,Q)(S))=f_(χ,Q)(S)^(p), ƒ_(χ,Q)(S)^(l+p) ¹⁰ ·l₁ is computed, and   [Formula 5] using Frobenius endomorphism φ_(p) of a value l of the rational point S(x_(s), y_(s)) on a line passing through rational points (Q₁, Q₂), Q₁,Q₂∈G₂, being a value of the rational point S(x_(s), y_(s)) on a line passing through rational points (pQ₁, pQ₂), the rational function f′_(χ,Q)(S) is computed by computing: ƒ_(χ,Q)(S)^(p+p) ³ ·l₃ which satisfies:   [Formula 7] ƒ_(χ,Q)(S)^(p+p) ³ ·l ₃=φ_(p) ³(ƒ_(χ,Q)(S)^(1+p) ¹⁰ ·l ₁).   [Formula 6]
 5. A pairing computation method for defining pairing e by using: G ₁ =E[r]∩Ker(φ_(p)−[1]), and G ₂ =E[r]∩Ker(φ_(p) −[p]), as a nondegenerate bilinear map: e:G₂×G₃→F*_(p) ^(k)/(F*_(p) ^(k))^(r), where: E is an additive group of rational points on a pairable elliptic curve defined over F_(p) ^(k) with an embedding degree of k, and the curve equation is given by y²=x³+ax+b where a∈F_(p) and b∈F_(p), E[r] is a set of rational points of a prime order r, and φ_(p) is Frobenius endomorphism, and computing pairing e(Q,S) where S∈G₁ and Q∈G₂ by an electronic calculator including a CPU, the pairing computation method comprising steps of, where t is a trace of the Frobenius endomorphism φ_(p), instead of computing the pairing e(Q,S) by using a rational function f_(t−1,Q)(S) calculated according to Miller's algorithm as: e(Q,S)=ƒ_(t−1,Q)(S)^((p) ^(k) ^(−1)/r), and   [Formula 2] the order r and the trace t of the Frobenius endomorphism φ_(p) are used as functions of an integer variable χ: causing the CPU of the electronic calculator to function as computation means for computing a rational function f_(χ,Q)(S); causing the CPU of the electronic calculator to function as computation means for computing a value of a rational point S(x_(s), y_(s)) on a line passing through a predetermined rational point; causing the CPU of the electronic calculator to function as computation means for computing a rational function f′_(χ,Q)(S) using results of the computations; and causing the CPU of the electronic calculator to function as computation means for performing computation by using the rational function f′_(χ,Q)(S) as: e(Q,S)=ƒ′_(χ,Q)(S)^((p) ^(k) ^(−1)/r).   [Formula 3]
 6. The pairing computation method according to claim 5, further comprising a step of causing the CPU of the electronic calculator to function as computation means for computing χQ and computing the predetermined rational point by using the result of the computation of χQ, after the step of computing the rational function f_(χ,Q)(S).
 7. A pairing computation program for defining pairing e by using: G₁ =E[r]∩Ker(φ_(p)−[1]), and G₂ =E[r]∩Ker(φ_(p) −[p]), as a nondegenerate bilinear map: e:G₂×G₁→F*_(p) ^(k)/(F*_(p) ^(k))^(r), where: E is an additive group of rational points on a pairable elliptic curve defined over F_(p) ^(k) with an embedding degree of k, and the curve equation is given by y²=x³+ax+b where a∈F_(p) and b∈F_(p), E[r] is a set of rational points of a prime order r, and φ_(p) is Frobenius endomorphism, and causing an electronic calculator including a CPU to compute pairing e(Q,S) where S∈G₁ and Q∈G₂, the pairing computation program causing the electronic calculator to function as, where t is a trace of the Frobenius endomorphism φ_(p), instead of causing computation of the pairing e(Q,S) by using a rational function f_(t−1,Q)(S) calculated according to Miller's algorithm as: e(Q,S)=∥_(t−1,Q)(S)^((p) ^(k) ^(−1)/r), and   [Formula 2] the order r and the trace t of the Frobenius endomorphism φ_(p) are used as functions of an integer variable χ: computation means for computing a rational function f_(χ,Q)(S); computation means for computing a value of a rational point S(x_(s), y_(s)) on a line passing through a predetermined rational point; computation means for computing a rational function f′_(χ,Q)(S) using results of the computations; and computation means for performing computation by using the rational function f′_(χ,Q)(S) as: e(Q,S)=ƒ′_(χ,Q)(S)^((p) ^(k) ^(−1)/r).   [Formula 3]
 8. The pairing computation program according to claim 7, wherein the pairing computation program causes the electronic calculator to function as computation means for computing χQ; and computation means for computing the predetermined rational point by using the result of the computation of χQ. 